Replacing a Security Server with an Omnissa Unified Access Gateway Appliance

Replace a security server with a Unified Access Gateway appliance.

Procedure

1. Uninstall the security server software.

2. Remove the security server's LDAP entry: vdmadmin -S [-bauthentication_arguments] -r -sserver

   See Removing the Entry for an Omnissa Horizon Connection Server Instance Using the -S Option in the Omnissa Horizon 8 Administration document.

3. In Omnissa Horizon Console, register the Unified Access Gateway appliance.

4. At the network firewall between Unified Access Gateway and Horizon Connection Server, remove firewall rules associated with the removed security server and add firewall rules associated with the incoming Unified Access Gateway. The Unified Access Gateway needs to communicate with Horizon Connection Server on TCP port 443.

   The back-end firewall rules for Security Server to Horizon Connection Server are as follows:

   Source	Default Port	Protocol	Destination	Default Port	Notes
   Security Server	UDP 500	ISAKMP	Horizon Connection Server	UDP 500	IPsec phase 1 negotiation.
   Security Server	UDP 4500	NAT-T	Horizon Connection Server	UDP 4500	Encapsulated AJP13 traffic when using NAT.
   Security Server		ESP	Horizon Connection Server		Encapsulated AJP13 traffic when NAT traversal is not required. ESP is IP protocol 50. Port numbers are not specified.
   Security Server		AJP13	Horizon Connection Server	TCP 8009	AJP13 traffic without IPsec and during pairing.
   Security Server		JMS	Horizon Connection Server	TCP 4001	Message channel for key negotiation.
   Security Server		JMS-TLS	Horizon Connection Server	TCP 4002	Message channel for management.

5. Configure and start the Unified Access Gateway appliance.

   See the Unified Access Gateway Deployment and Configuration Guide available at the Unified Access Gateway documentation.